38576 matches found
CVE-2026-72769 n8n before 1.123.67 Prototype Pollution via VM Expression Engine
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow expression can abuse the engine's array-element access to obtain a reference to a host built-in and pollute its prototype in th...
EUVD-2026-56095
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow expression can abuse the engine's array-element access to obtain a reference to a host built-in and pollute its prototype in th...
CVE-2026-72769
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow expression can abuse the engine's array-element access to obtain a reference to a host built-in and pollute its prototype in th...
CVE-2026-72769 n8n before 1.123.67 Prototype Pollution via VM Expression Engine
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow expression can abuse the engine's array-element access to obtain a reference to a host built-in and pollute its prototype in th...
Exploit for Use After Free in Mozilla Firefox
CVE-2026-2766, but with wasm Status: validated crash PoC U...
CVE-2026-18708: Improper Control of Generation of Code
An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could...
CVE-2026-18711: Use After Free
An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server...
WordPress AI Engine authorization bypass vulnerability
WordPress AI Engine is a core component of the official WordPress plugin library developed by developer JordyMeow. Its purpose is to integrate multi-model AI capabilities chatbots, content generation, MCP smart agents, etc. directly into the WordPress backend, allowing for easy invocation of...
CVE-2026-17061: Deserialization of Untrusted Data
A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution...
CVE-2026-45618: Improper Control of Generation of Code
LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue...
PT-2026-70211
Name of the Vulnerable Software and Affected Versions SIMULIA Execution Engine versions Release 2023 through Release 2026 Description A Deserialization of Untrusted Data issue exists, which could allow an unauthenticated attacker to achieve remote code execution. Deserialization is the process of...
PT-2026-70171
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow expression can abuse the engine's array-element access to obtain a reference to a host built-in and pollute its prototype in th...
CVE-2026-72769: Improperly Controlled Modification of Object Prototype Attributes
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow expression can abuse the engine's array-element access to obtain a reference to a host built-in and pollute its prototype in th...
PT-2026-70595
Name of the Vulnerable Software and Affected Versions Windows Backup Engine affected versions not specified Description A race condition occurs in the Windows Backup Engine due to improper synchronization when using a shared resource. This allows an authorized attacker to elevate privileges local...
CVE-2026-62908: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Backup Engine allows an authorized attacker to elevate privileges locally...
Microsoft Edge 150.0.4078.48 Type Confusion
Microsoft Edge version 150.0.4078.48 suffers from a type confusion vulnerability. Exploit Title: Microsoft Edge 150.0.4078.48 - RCE CVE: CVE-2026-58289 Date: 2026-07-10 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram: @banyamersecurity Author GitHub:...
PT-2026-70863
Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue in the query execution engine allows an authenticated user with read and write privileges to trigger a use-after-free condition when executing specific queries against...
WordPress AI Engine path traversal vulnerability
WordPress AI Engine is a core component of the official WordPress plugin library developed by developer JordyMeow. Its purpose is to integrate multi-model AI capabilities chatbots, content generation, MCP smart agents, etc. natively into the WordPress backend, allowing for easy invocation of...
CVE-2026-12624
Vault’s ACL policy engine allowed LIST requests with a trailing slash on denied paths to bypass a narrow wildcard deny when a token had a broad allow. This could enable enumeration of names under a denied path. Affected products include Vault Community Edition, with fixes in 2.0.3, and Vault Ente...
